en
Feedback
Android Security & Malware

Android Security & Malware

Open in Telegram

๐Ÿ“ˆ Analytical overview of Telegram channel Android Security & Malware

Channel Android Security & Malware (@androidmalware) in the English language segment is an active participant. Currently, the community unites 43 891 subscribers, ranking 3 094 in the Technologies & Applications category and 727 in the USA region.

๐Ÿ“Š Audience metrics and dynamics

Since its creation on ะฝะตะฒั–ะดะพะผะพ, the project has demonstrated rapid growth, gathering an audience of 43 891 subscribers.

According to the latest data from 14 June, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 168 over the last 30 days and by 10 over the last 24 hours, overall reach remains high.

  • Verification status: Not verified
  • Engagement rate (ER): The average audience engagement rate is 11.91%. Within the first 24 hours after publication, content typically collects 4.63% reactions from the total number of subscribers.
  • Post reach: On average, each post receives 5 227 views. Within the first day, a publication typically gains 2 032 views.
  • Reactions and interaction: The audience actively supports content: the average number of reactions per post is 12.
  • Thematic interests: Content is focused on key topics such as cve-2025, exploit, rat, trojan, bypass.

๐Ÿ“ Description and content policy

The author describes the resource as a platform for expressing subjective opinions:
โ€œMobile cybersecurity channel Links: https://linktr.ee/mobilehacker Contact: mobilehackerofficial@gmail.comโ€

Thanks to the high frequency of updates (latest data received on 15 June, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.

43 891
Subscribers
+1024 hours
+887 days
+16830 days
Posts Archive
Analysis of recent Android NGate malware campaign (NFC relay) in Poland https://cert.pl/en/posts/2025/11/analiza-ngate/ Demo: https://x.com/androidmalware2/status/1986406590866727047

Frida JDWP Loader This tool dynamically attaches Frida to any debuggable Android process over JDWP, enabling runtime instrume
Frida JDWP Loader This tool dynamically attaches Frida to any debuggable Android process over JDWP, enabling runtime instrumentation without root access. Perfect for dynamic app analysis, quick pentesting, bug bounty https://github.com/frankheat/frida-jdwp-loader Video demo: https://x.com/androidmalware2/status/1986022672472359017

Exploiting CVE-2025-21479 on a Samsung S23 https://xploitbengineer.github.io/CVE-2025-21479

The Rise of NFC Relay Malware on Mobile Devices Cybercriminals are spreading NFC relay malware that tricks you into placing y
The Rise of NFC Relay Malware on Mobile Devices Cybercriminals are spreading NFC relay malware that tricks you into placing your card against your phoneโ€™s NFC chip. Once you do, the malware silently captures and relays your card data to fraudsters, who can use it for unauthorized payments or ATM withdrawals. Reports show these scams are growing fast across the globe, with hundreds of malicious apps already detected. https://zimperium.com/blog/tap-and-steal-the-rise-of-nfc-relay-malware-on-mobile-devices

[beginners] Deep dive into Android Pentesting Covered everything from static & dynamic analysis, Frida, Drozer, SSL pinning b
[beginners] Deep dive into Android Pentesting Covered everything from static & dynamic analysis, Frida, Drozer, SSL pinning bypass, deep links, broadcast receivers, and more If you're into mobile security, this one's packed with real-world scenarios & tools https://coal-memory-97b.notion.site/Android-Pentest-1f6923af30cc80bdafa4f3c581f4c5f8

GhostGrab is a new Android malware blending crypto mining with banking credential theft. It hijacks SMS OTPs, harvests PII, a
GhostGrab is a new Android malware blending crypto mining with banking credential theft. It hijacks SMS OTPs, harvests PII, and runs a hidden Monero minerโ€”draining battery while stealing funds. It compromised over 30 devices and C&C server leaks over 2800 victim SMS https://www.cyfirma.com/research/ghostgrab-android-malware/

New Android Malware Herodotus Mimics Human Behaviour to Evade Detection https://www.threatfabric.com/blogs/new-android-malware-herodotus-mimics-human-behaviour-to-evade-detection

Vulnerability in Google Messages for Wear OS resulted in invoking intents to send messages without permission (CVE-2025-12080
Vulnerability in Google Messages for Wear OS resulted in invoking intents to send messages without permission (CVE-2025-12080) and awarded $2,250.00 by Google Blog: https://towerofhanoi.it/writeups/cve-2025-12080/ PoC: https://github.com/io-no/CVE-Reports/tree/main/CVE-2025-12080

How 1-click iOS exploit chains work (WebKit exploitation basics) https://youtu.be/o6mVgygo-hk

Android backdoor hijacks Telegram accounts, gaining complete control over them https://news.drweb.com/show/?i=15076&lng=en&c=5

Samsung Galaxy S25 pwned Yesterday at Pwn2Own Ken Gannon and Dimitrios Valsamaras used five different bugs to exploit the Sam
Samsung Galaxy S25 pwned Yesterday at Pwn2Own Ken Gannon and Dimitrios Valsamaras used five different bugs to exploit the Samsung Galaxy S25 and earn $50,000

HyperRat โ€“ A New Android RAT Sold On Cybercrime Networks https://iverify.io/blog/hyperrat-a-new-android-rat-sold-on-cybercrime-networks

Patching Android ARM64 library initializers for easy Frida instrumentation and debugging https://blog.nviso.eu/2025/10/14/patching-android-arm64-library-initializers-for-easy-frida-instrumentation-and-debugging/

Account takeover in Android app via JavaScript bridge A misconfigured addJavascriptInterface + flawed domain validation + jav
Account takeover in Android app via JavaScript bridge A misconfigured addJavascriptInterface + flawed domain validation + javascript:// trick enabled full cookie exfiltration via WebView. Exploit chain: JSB dispatcher โ†’ file access handler โ†’ bypass via newline injection. Payload: Delivered via deeplink. Executed JSB call to toBase64. Read Cookies file from app sandbox. Exfiltrated session data via callback. https://tuxplorer.com/posts/account-takeover-via-jsb/